The review, expected to last 12 weeks, is not expected to delay the deployment of the new system to the Columbus, Ohio, VA medical center this summer. But department officials acknowledged that “the order of subsequent deployments may be revised as a result of this strategic review.”

Last month, officials from the Government Accountability Office recommended postponing further expansion of the project until lingering issues with the system are resolved. They said as of last fall, “VA was at risk of deploying a system that did not perform as intended and could negatively impact the likelihood of its successful adoption.”

Department officials framed the new review as an assessment by the new administration to ensure that project timelines and requirements are realistic.

“A successful electronic health records deployment is essential in the delivery of lifetime, world-class health care for our Veterans,” VA Secretary Denis McDonough said in a statement.

“After a rigorous review of our most-recent deployment at Mann-Grandstaff VA Medical Center [in Washington], it is apparent that a strategic review is necessary. VA remains committed to the Cerner Millennium solution, and we must get this right for veterans.”

VA officials separately emphasized that the review is not aimed at looking whether the entire project should be reconsidered, but instead only at the pace of deployment and advance requirement needs for that work.

The 10-year health records project — heavily touted by former President Donald Trump’s administration as a transformation effort for VA — is designed to bring veterans and military medical software into alignment, allowing lifelong medical records to follow service members from through Defense Department clinics, VA medical appointments and even health visits outside the federal systems.

But deployment of Cerner’s Millennium software, already in use at the Defense Department, has had a difficult start. Democrats and Republicans on Capitol Hill have promised close scrutiny on the new records system in the coming year, both because of the scope of the project and the reports of uneven progress in the initial stages.

Earlier this week, Rep. Cathy McMorris Rodgers, R-Wash., set a letter to McDonough complaining of “new stress on the Mann-Grandstaff VA Medical Center” — the first site to use the new system — because of shortcomings with the new records implementation.

“I am hearing from some [employees] who are deeply frustrated with the system and are not getting the support they need,” she wrote. “Nurses who go to work every day to serve our veterans should not be driven to tears because software, which was intended to be an improvement, makes their jobs more difficult.”

She also raised concerns about patient safety, citing multiple reports of prescription delays linked to the new system. Officials from Cerner have disputed whether that is a widespread problem.

They have also said that many of the initial challenges with deploying the new system were expected, and technical experts from their company and VA built space into their deployment timelines to account for improvements needed as those problems have arisen.

“Cerner supports the decision by VA to conduct a strategic program review,” said Brian Sandager, general manager of Cerner Government Services, in a statement.

“We are proud of the significant milestones we have achieved, including one of the largest health data migrations in history and the deployment of a new joint Health Information Exchange between DOD, VA and their community partners. As committed partners we welcome and value the opportunity to review the program and share lessons learned.”

VA officials have already moved more than 24 million veteran health records into the new system. All VA facilities are expected to be using the system by the end of 2028.

Maze, a hacking and ransomware group, has breached several law firms, local government databases and other companies, demanding payments for data recovery and deletion. The posted information includes VA documents, patient care records, legal fee agreements and privacy consent forms.

Two of those hacks targeted Texas-based law firm Baker Wotring in November and Woods and Woods LLC in Evansville, Indiana, this month, the Evansville Courier & Press reported.

Woods and Woods is a nationwide disability benefits firm that deals with U.S. Department of Veterans Affairs litigation.

“[Woods and Woods LLC] has notified the FBI and has taken and continues to take prompt action to contain the incident, mitigate its effects, and fully investigate,” said Neil Woods in an emailed statement to Military Times. “The firm is able to continue conducting its business since it had backups in place. The firm will provide additional information to its clients as the investigation continues.”

It is unclear, however, whether clients from the firms are aware some of their sensitive information has already posted to the web.

Baker Wotring did not respond to a request for comment.

Maze hacks an organization’s servers, notifies them of the breach and demands ransom payments to prevent data dumps, according to Brett Callow, a threat analyst with Emsisoft. If the group does not receive payment, it will publish small amounts of compromised data — “proofs” — online, accessible to anyone with internet access.

The group has previously demanded payments ranging from $1 million to several million dollars, and if payment is not received, Maze will release additional sensitive data on a staggered basis, Callow explained. Maze has already released a portion of personal documents from Woods and Woods, and the group claims to have more information.

Maze has also posted the compromised data to a Russian hacker forum, Callow said.

In some cases, other hackers will use the stolen information to target and demand ransom from individual patients or clients. Maze itself wrote on its site, “Use this information in any nefarious way that you want,” Callow said.

Ransomware and malware breaches have become devastated organizations in recent years, often crippling their ability to function or demands extraordinary sums of money.

A 2019 Emsisoft report found that 113 state and municipal governments and agencies, 764 health care providers, and 89 universities, colleges and school districts nationwide.

These groups prefer to target smaller firms with less secure cybersecurity infrastructure, Callow previously told Law.com. The Federal Bureau of Investigation (FBI) issued a Flash Alert last month to private companies to notify them of increased Maze ransomware activities, BleepingComputer reported.